Security Bulletin: Security Vulnerability found in zlib fixed in the zlib version shipped with IBM Security Verify for Gateway (RADIUS & WinLogin) and for Bridge (DirSync)

Summary

The security vulnerability(heap-based buffer overflow) found in zlib was fixed in the following products: IBM Security Verify Gateway for RADIUS (v1.0.8), IBM Security Verify Gateway for Windows Login (v1.0.9) and IBM Security Verify Bridge for Directory Sync (v1.0.10)

Vulnerability Details

CVEID:CVE-2022-37434
**DESCRIPTION:**zlib is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by inflate in inflate.c. By using a large gzip header extra field, a remote attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base score: 7.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/232849 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

IBM Security Verify Gateway for RADIUS
<https://exchange.xforce.ibmcloud.com/hub/extension/d39efc0e03582d3eed3263d7e7022058&gt;

IBM Security Verify Gateway for Windows Login
<https://exchange.xforce.ibmcloud.com/hub/extension/103b558c1aa73755641fe45493db3301&gt;

IBM Security Verify Bridge for Directory Sync
<https://exchange.xforce.ibmcloud.com/hub/extension/9fc025a9db848ac27640110e141429bd&gt;

Workarounds and Mitigations

None